@yu_robotics/remote-cli 1.6.53 → 1.6.66

package/dist/executor/ClaudePersistentExecutor.js

@@ -6,9 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClaudePersistentExecutor = void 0;
 const child_process_1 = require("child_process");
 const ClaudeCodeHooks_1 = require("../hooks/ClaudeCodeHooks");
+const ClaudeSandbox_1 = require("./claude/ClaudeSandbox");
+const ClaudeFilePolicy_1 = require("./claude/ClaudeFilePolicy");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
+const net_1 = __importDefault(require("net"));
+const crypto_1 = require("crypto");
 const events_1 = require("events");
 /**
  * Claude Persistent Executor
@@ -61,12 +65,32 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
     inputRequestCallbacks = [];
     inputDetectionTimer;
     lastOutputTime = 0;
+    // Sandbox and approval state
+    sandbox;
+    claudeCommand;
+    approvalServer = null;
+    approvalSocketPath;
+    approvalGeneration = 0;
+    approvalTurnActive = false;
+    pendingApprovals = new Map();
+    currentApprovalRequestCallback;
+    currentApprovalResolvedCallback;
+    filePolicyToken;
+    filePolicyRoots = [];
+    filePolicyStarted = false;
+    onFilePolicyStarted;
+    static APPROVAL_TIMEOUT_MS = 5 * 60 * 1000;
+    static APPROVAL_SERVER_SCRIPT = path_1.default.join(__dirname, 'claude', 'approvalMcpServer.js');
+    static APPROVAL_TOOL_NAME = 'mcp__remote-cli-approval__approval_prompt';
+    static FILE_POLICY_SCRIPT = path_1.default.join(__dirname, 'claude', 'filePolicyHook.js');
     // Activity tracking for timeout extension (optional, can be disabled)
     activityTrackingEnabled = false;
-    constructor(directoryGuard, initialWorkingDirectory, threadId, model) {
+    constructor(directoryGuard, initialWorkingDirectory, threadId, model, sandbox, claudeCommand) {
         super();
         this.directoryGuard = directoryGuard;
         this.model = model;
+        this.sandbox = new ClaudeSandbox_1.ClaudeSandbox(directoryGuard, sandbox, threadId);
+        this.claudeCommand = claudeCommand ?? 'claude';
         // Use provided working directory or fall back to process.cwd()
         // If a working directory is provided, validate it first
         if (initialWorkingDirectory) {
@@ -213,14 +237,48 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
             }
             // Build arguments
             // Note: --output-format=stream-json requires --verbose
+            const restricted = this.sandbox.isRestricted();
             const args = [
                 '--input-format=stream-json',
                 '--output-format=stream-json',
                 '--include-partial-messages',
                 '--verbose',
-                '--dangerously-skip-permissions',
-                '--disallowedTools=AskUserQuestion'
             ];
+            if (restricted) {
+                // Sandboxed mode: OS-enforced Bash isolation; widening requests surface
+                // through the permission-prompt MCP tool as approval cards. Skipping
+                // permissions would silence that channel, so it is omitted on purpose.
+                this.sandbox.assertAvailable(this.currentWorkingDirectory);
+                // Override native acceptEdits/auto/bypass defaults for this process.
+                args.push('--permission-mode', 'default');
+                const socketPath = await this.ensureApprovalServer();
+                let fileHookCommand;
+                if (this.sandbox.getConfig()?.mode === 'workspace-write') {
+                    this.filePolicyToken = (0, crypto_1.randomUUID)();
+                    this.filePolicyStarted = false;
+                    this.filePolicyRoots = [this.sandbox.normalize(this.currentWorkingDirectory), ...this.sandbox.extraWritableRoots()];
+                    const quote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
+                    // A failed hook launch must block the tool, not fall through to native allow rules.
+                    fileHookCommand = [process.execPath, ClaudePersistentExecutor.FILE_POLICY_SCRIPT, socketPath, this.filePolicyToken]
+                        .map(quote).join(' ') + ' || exit 2';
+                }
+                const settings = this.sandbox.spawnSettings(this.currentWorkingDirectory, fileHookCommand);
+                if (settings)
+                    args.push('--settings', JSON.stringify(settings));
+                args.push('--mcp-config', JSON.stringify({
+                    mcpServers: {
+                        'remote-cli-approval': {
+                            command: process.execPath,
+                            args: [ClaudePersistentExecutor.APPROVAL_SERVER_SCRIPT, socketPath],
+                        },
+                    },
+                }));
+                args.push('--permission-prompt-tool', ClaudePersistentExecutor.APPROVAL_TOOL_NAME);
+            }
+            else {
+                args.push('--dangerously-skip-permissions');
+            }
+            args.push('--disallowedTools=AskUserQuestion');
             if (this.model) {
                 args.push('--model', this.model);
             }
@@ -231,10 +289,10 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
             else {
                 console.log('[ClaudePersistent] Starting new session');
             }
-            console.log(`[ClaudePersistent] Starting: claude ${args.join(' ')}`);
+            console.log(`[ClaudePersistent] Starting: ${this.claudeCommand} ${args.join(' ')}`);
             console.log(`[ClaudePersistent] Working directory: ${this.currentWorkingDirectory}`);
             // Spawn the process
-            const child = (0, child_process_1.spawn)('claude', args, {
+            const child = (0, child_process_1.spawn)(this.claudeCommand, args, {
                 cwd: this.currentWorkingDirectory,
                 stdio: ['pipe', 'pipe', 'pipe'],
                 env: {
@@ -299,6 +357,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
             // Use 'close' event (fires after all I/O streams are closed, i.e. after all stdout
             // data events have been processed) instead of 'exit' for command completion logic.
             child.on('close', (code, signal) => {
+                this.clearApprovals('Claude process exited');
                 this.claudeProcess = null;
                 // Check if this was an intentional stop (abort/reset)
                 const wasIntentionalStop = this.isStopping;
@@ -363,9 +422,21 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
                 }
                 throw err;
             }
+            if (this.filePolicyToken) {
+                try {
+                    // SessionStart runs before stdin is consumed. Do not send a user task
+                    // unless the native hook is active; disabled/managed-only hooks fail closed.
+                    await this.waitForFilePolicy(child);
+                }
+                catch (error) {
+                    await this.stopProcess();
+                    throw error;
+                }
+            }
             // Long-running error handler for errors that occur after startup
             child.on('error', (error) => {
                 console.error('[ClaudePersistent] Process error:', error);
+                this.clearApprovals('Claude process failed');
                 this.claudeProcess = null;
                 this.isStarting = false;
                 if (this.currentCommandReject) {
@@ -397,6 +468,10 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
      * Stop the persistent Claude process
      */
     async stopProcess() {
+        this.filePolicyToken = undefined;
+        this.filePolicyRoots = [];
+        this.filePolicyStarted = false;
+        this.clearApprovals('Claude process stopped');
         if (!this.claudeProcess) {
             return;
         }
@@ -425,6 +500,212 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
         this.claudeProcess = null;
         console.log('[ClaudePersistent] Process stopped');
     }
+    // ── Sandbox approval channel ─────────────────────────────────────────────
+    waitForFilePolicy(child) {
+        if (this.filePolicyStarted && this.claudeProcess === child)
+            return Promise.resolve();
+        return new Promise((resolve, reject) => {
+            const finish = (error) => {
+                clearTimeout(timer);
+                this.onFilePolicyStarted = undefined;
+                child.removeListener('close', onClose);
+                child.removeListener('error', onError);
+                error ? reject(error) : resolve();
+            };
+            const onClose = () => finish(new Error('Claude exited before sandbox file checks started.'));
+            const onError = (error) => finish(error);
+            const timer = setTimeout(() => finish(new Error('Claude sandbox file checks did not start. Check native hook restrictions (disableAllHooks or allowManagedHooksOnly).')), 10000);
+            this.onFilePolicyStarted = () => finish();
+            child.once('close', onClose);
+            child.once('error', onError);
+            if (this.claudeProcess !== child)
+                onClose();
+        });
+    }
+    async ensureApprovalServer() {
+        if (this.approvalServer && this.approvalSocketPath)
+            return this.approvalSocketPath;
+        const directory = path_1.default.join(os_1.default.homedir(), '.remote-cli', 'claude-approval');
+        fs_1.default.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        const socketPath = path_1.default.join(directory, `${encodeURIComponent(this.threadId || (0, crypto_1.randomUUID)())}.sock`);
+        if (fs_1.default.existsSync(socketPath))
+            fs_1.default.unlinkSync(socketPath); // stale socket from a previous run
+        this.approvalServer = net_1.default.createServer((socket) => {
+            const generation = this.approvalGeneration;
+            let buffer = '';
+            socket.on('error', () => { });
+            socket.on('data', (chunk) => {
+                buffer += chunk;
+                let index;
+                while ((index = buffer.indexOf('\n')) >= 0) {
+                    const line = buffer.slice(0, index);
+                    buffer = buffer.slice(index + 1);
+                    if (!line.trim())
+                        continue;
+                    try {
+                        this.handleApprovalSocketRequest(JSON.parse(line), socket, generation);
+                    }
+                    catch (error) {
+                        console.error('[ClaudePersistent] Failed to handle approval request:', error);
+                        socket.end();
+                    }
+                }
+            });
+        });
+        await new Promise((resolve, reject) => {
+            this.approvalServer.once('error', reject);
+            this.approvalServer.listen(socketPath, () => resolve());
+        });
+        fs_1.default.chmodSync(socketPath, 0o600);
+        this.approvalSocketPath = socketPath;
+        return socketPath;
+    }
+    handleApprovalSocketRequest(payload, socket, generation) {
+        if (payload?.type === 'file_policy') {
+            let answer = { decision: 'deny', reason: 'File policy request is no longer active.' };
+            if (this.filePolicyToken && payload.token === this.filePolicyToken && this.claudeProcess
+                && !this.isDestroyed && !this.isStopping) {
+                if (payload.startup === true) {
+                    this.filePolicyStarted = true;
+                    this.onFilePolicyStarted?.();
+                    answer = { decision: 'allow', reason: 'File policy ready.' };
+                }
+                else if (this.isProcessing && this.approvalTurnActive && generation === this.approvalGeneration) {
+                    answer = (0, ClaudeFilePolicy_1.evaluateFileWrite)(payload.tool_name, payload.input ?? {}, this.filePolicyRoots);
+                }
+            }
+            socket.end(JSON.stringify(answer) + '\n');
+            return;
+        }
+        const requestId = typeof payload?.id === 'string' ? payload.id : (0, crypto_1.randomUUID)();
+        if (this.isDestroyed || this.isStopping || !this.isProcessing || !this.approvalTurnActive
+            || (!this.currentCommandResolve && !this.currentCommandReject)
+            || generation !== this.approvalGeneration || this.pendingApprovals.has(requestId)) {
+            socket.end(JSON.stringify({ id: requestId, behavior: 'deny', message: 'Approval request is no longer active.' }) + '\n');
+            return;
+        }
+        const toolName = typeof payload?.tool_name === 'string' ? payload.tool_name : 'unknown';
+        const input = (payload?.input && typeof payload.input === 'object') ? payload.input : {};
+        const kind = toolName === 'Bash' ? 'command'
+            : (toolName === 'Write' || toolName === 'Edit' || toolName === 'NotebookEdit') ? 'file'
+                : 'permissions';
+        const description = toolName === 'Bash'
+            ? String(input.command ?? '').slice(0, 500)
+            : `${toolName}: ${String(input.file_path ?? input.notebook_path ?? input.path ?? JSON.stringify(input)).slice(0, 500)}`;
+        const timer = setTimeout(() => {
+            this.answerApproval(requestId, { behavior: 'deny', message: 'Approval request expired' }, 'expired');
+        }, ClaudePersistentExecutor.APPROVAL_TIMEOUT_MS);
+        timer.unref?.();
+        socket.on('close', () => {
+            const pending = this.pendingApprovals.get(requestId);
+            if (pending?.socket === socket)
+                this.answerApproval(requestId, { behavior: 'deny', message: 'Approval connection closed' }, 'expired');
+        });
+        this.pendingApprovals.set(requestId, { socket, timer, input, description, generation,
+            resolved: this.currentApprovalResolvedCallback });
+        let cardShown = false;
+        try {
+            cardShown = this.currentApprovalRequestCallback?.({ requestId, kind, description, canRemember: false }) === true;
+        }
+        catch { /* A rendering failure can fall back to the text prompt. */ }
+        if (!cardShown && this.pendingApprovals.has(requestId)) {
+            if (this.currentStreamCallback) {
+                this.currentStreamCallback(`\nApproval required (${requestId}): ${description}\nReply yes or no. For multiple requests, reply yes <request ID> or no <request ID>.\n`);
+            }
+            else {
+                this.answerApproval(requestId, { behavior: 'deny', message: 'No interactive approval channel is available.' }, 'denied');
+            }
+        }
+    }
+    answerApproval(requestId, answer, status) {
+        const pending = this.pendingApprovals.get(requestId);
+        if (!pending)
+            return false;
+        this.pendingApprovals.delete(requestId);
+        clearTimeout(pending.timer);
+        let delivered = !pending.socket.destroyed && pending.socket.writable;
+        if (delivered) {
+            try {
+                pending.socket.end(JSON.stringify({ id: requestId, ...answer }) + '\n');
+            }
+            catch {
+                delivered = false;
+            }
+        }
+        try {
+            pending.resolved?.(requestId, delivered ? status : 'expired');
+        }
+        catch { /* Card cleanup failures must not reactivate an answered request. */ }
+        return delivered;
+    }
+    /** MessageHandler entry point for approval card actions. */
+    respondToApproval(requestId, action) {
+        const pending = this.pendingApprovals.get(requestId);
+        if (!pending || !['approve', 'deny'].includes(action))
+            return false;
+        if (pending.generation !== this.approvalGeneration || !this.approvalTurnActive
+            || !this.isProcessing || this.isStopping || this.isDestroyed) {
+            this.answerApproval(requestId, { behavior: 'deny', message: 'Approval request expired' }, 'expired');
+            return false;
+        }
+        if (action === 'deny') {
+            return this.answerApproval(requestId, { behavior: 'deny', message: 'Denied by user' }, 'denied');
+        }
+        return this.answerApproval(requestId, { behavior: 'allow', updatedInput: pending.input }, 'approved');
+    }
+    denyAllPendingApprovals(message) {
+        for (const requestId of Array.from(this.pendingApprovals.keys())) {
+            this.answerApproval(requestId, { behavior: 'deny', message }, 'expired');
+        }
+    }
+    clearApprovals(message) {
+        this.approvalGeneration++;
+        this.approvalTurnActive = false;
+        this.currentApprovalRequestCallback = undefined;
+        this.currentApprovalResolvedCallback = undefined;
+        this.denyAllPendingApprovals(message);
+    }
+    getSandboxStatus() {
+        return this.sandbox.describe(this.currentWorkingDirectory);
+    }
+    async configureSandbox(command) {
+        if (this.isProcessing || this.commandQueue.length > 0) {
+            return { success: false, error: 'Wait for the running task before changing sandbox settings.' };
+        }
+        try {
+            const match = /^(\S+)(?:\s+([\s\S]*))?$/.exec(command.trim());
+            const action = match?.[1] ?? '';
+            const value = match?.[2] ?? '';
+            const config = this.sandbox.getConfig() ?? { mode: 'workspace-write' };
+            let next = { ...config };
+            if (action === 'default' && !value)
+                next = undefined;
+            else if (['on', 'off', 'read-only'].includes(action) && !value) {
+                next.mode = action === 'on' ? 'workspace-write' : action === 'off' ? 'danger-full-access' : 'read-only';
+            }
+            else if (action === 'network' && ['on', 'off'].includes(value))
+                next.networkAccess = value === 'on';
+            else if (['allow', 'remove'].includes(action) && value) {
+                const directory = this.sandbox.normalize(value, this.currentWorkingDirectory);
+                next.writableRoots = action === 'allow'
+                    ? [...new Set([...(config.writableRoots ?? []), directory])]
+                    : (config.writableRoots ?? []).filter(root => root !== directory);
+                if (action === 'remove' && next.writableRoots.length === (config.writableRoots ?? []).length) {
+                    return { success: false, error: 'That directory is not an extra grant.' };
+                }
+            }
+            else
+                return { success: false, error: 'Usage: /sandbox on|off|read-only|default; /sandbox network on|off; /sandbox allow|remove <directory>' };
+            this.sandbox.configure(next);
+            // Sandbox settings are spawn-time arguments; restart to apply. The saved
+            // session id keeps the conversation intact across the respawn.
+            await this.stopProcess();
+            return { success: true, output: this.getSandboxStatus() };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
     /**
      * Reset the command timeout timer when activity is detected
      * This prevents timeout during long-running tasks with continuous output
@@ -866,6 +1147,16 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
      * This is called by MessageHandler when user sends a message while waiting for input
      */
     sendInput(input) {
+        if (this.pendingApprovals.size > 0) {
+            const match = /^(yes|y|approve|accept|no|n|deny|decline|cancel)(?:\s+(\S+))?$/i.exec(input.trim());
+            const requestId = match?.[2] ?? (this.pendingApprovals.size === 1 ? this.pendingApprovals.keys().next().value : undefined);
+            if (!match || !requestId || !this.pendingApprovals.has(requestId)) {
+                this.currentStreamCallback?.(`\nReply yes or no for a single approval, or specify yes <request ID> / no <request ID>:\n${Array.from(this.pendingApprovals, ([id, pending]) => `${id}: ${pending.description}`).join('\n')}\n`);
+                return false;
+            }
+            const action = ['yes', 'y', 'approve', 'accept'].includes(match[1].toLowerCase()) ? 'approve' : 'deny';
+            return this.respondToApproval(requestId, action);
+        }
         if (!this.claudeProcess || !this.isWaitingForInput) {
             console.log('[ClaudePersistent] Cannot send input - process not running or not waiting for input');
             return false;
@@ -892,7 +1183,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
      * Check if currently waiting for user input
      */
     isWaitingInput() {
-        return this.isWaitingForInput;
+        return this.pendingApprovals.size > 0 || this.isWaitingForInput;
     }
     /**
      * Complete the current command
@@ -958,6 +1249,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
      * Reset current command state
      */
     resetCurrentCommand() {
+        this.clearApprovals('Task is no longer active');
         this.currentOutputBuffer = [];
         this.textStreams.clear();
         this.currentStreamCallback = undefined;
@@ -984,7 +1276,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
      * Process the command queue
      */
     async processQueue() {
-        if (this.isProcessing || this.commandQueue.length === 0) {
+        if (this.isProcessing || this.isStarting || this.commandQueue.length === 0) {
             return;
         }
         // Ensure process is running
@@ -1022,6 +1314,9 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
         this.currentToolResultCallback = command.options.onToolResult;
         this.currentRedactedThinkingCallback = command.options.onRedactedThinking;
         this.currentPlanModeCallback = command.options.onPlanMode;
+        this.currentApprovalRequestCallback = command.options.onApprovalRequest;
+        this.currentApprovalResolvedCallback = command.options.onApprovalResolved;
+        this.approvalTurnActive = true;
         this.currentCommandResolve = command.resolve;
         this.currentCommandReject = command.reject;
         // Reset output buffer: Claude Code 2.x can emit autonomous turns while
@@ -1122,7 +1417,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
      * Stops the current process and rejects the pending command
      */
     async abort() {
-        if (!this.isProcessing && !this.isWaitingForInput) {
+        if (!this.isProcessing && !this.isWaitingInput()) {
             console.log('[ClaudePersistent] No command is currently executing');
             return false;
         }
@@ -1136,6 +1431,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
             }
         }
         console.log('[ClaudePersistent] Aborting current command...');
+        this.denyAllPendingApprovals('Task aborted by user');
         // Emit task aborted hook before stopping
         if (this.currentTaskId) {
             ClaudeCodeHooks_1.claudeCodeHooks.notifyTaskAborted({
@@ -1268,7 +1564,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
         await this.stopProcess();
         // Step 2: Run compact as a one-shot process outside the full context
         const compactResult = await new Promise((resolve) => {
-            const child = (0, child_process_1.spawn)('claude', ['--resume', sessionIdBeforeCompact, '--print', '/compact'], {
+            const child = (0, child_process_1.spawn)(this.claudeCommand, ['--resume', sessionIdBeforeCompact, '--print', '/compact'], {
                 cwd: this.currentWorkingDirectory,
                 stdio: ['ignore', 'pipe', 'pipe'],
                 env: { ...process.env, FORCE_COLOR: '0', CLAUDECODE: '', CLAUDE_CODE: '' },
@@ -1317,6 +1613,13 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
             command.reject(new Error('Executor has been destroyed'));
         }
         this.commandQueue = [];
+        this.clearApprovals('Executor destroyed');
+        if (this.approvalServer) {
+            const server = this.approvalServer;
+            this.approvalServer = null;
+            this.approvalSocketPath = undefined;
+            await new Promise(resolve => server.close(() => resolve()));
+        }
         if (this.currentCommandReject) {
             this.currentCommandReject(new Error('Executor has been destroyed'));
             this.resetCurrentCommand();
@@ -1338,6 +1641,7 @@ class ClaudePersistentExecutor extends events_1.EventEmitter {
         catch {
             // File may not exist — not an error
         }
+        this.sandbox.deleteData();
     }
     /**
      * Check if process is running